CVE-2020-36759: Woody code snippets <= 2.3.9 - Cross-Site Request Forgery Bypass
The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36759?
CVE-2020-36759 is considered a significant security vulnerability due to its potential for Cross-Site Request Forgery, allowing unauthorized actions.
How do I fix CVE-2020-36759?
To fix CVE-2020-36759, update the Woody Code Snippets plugin to version 2.4.0 or later, which addresses the nonce validation issue.
Who is affected by CVE-2020-36759?
Websites using versions of the Woody Code Snippets plugin up to and including 2.3.9 are vulnerable to CVE-2020-36759.
What kind of attacks can CVE-2020-36759 enable?
CVE-2020-36759 allows unauthenticated attackers to activate and deactivate code snippets, potentially compromising the site's functionality.
Is authentication required to exploit CVE-2020-36759?
No, authentication is not required, making CVE-2020-36759 particularly dangerous as it allows unauthenticated users to perform attacks.